CVE-2026-18453: NULL Pointer Dereference in Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8

CVE-2026-18453 is a vulnerability in 389 Directory Server where a missing NULL pointer check in the paged results handling of the op_shared_search function allows an unauthenticated remote attacker to cause a denial of service by crashing the LDAP server. The attack is performed by sending a crafted sequence of search requests using the USE_ONE_BACKEND control. The flaw leads to a NULL pointer dereference and crash of the directory server process, stopping directory lookups and authentication until the service is restarted. The vulnerability affects Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 versions. Red Hat has issued a security advisory and released updated packages to address this issue.

An unauthenticated remote attacker with network access to the LDAP service can crash the 389 Directory Server process, resulting in denial of service. This stops directory lookups and authentication that depend on the service until the process is restarted. There is no impact on confidentiality or integrity of directory data. The attack is easy to repeat. Disabling anonymous LDAP access removes the unauthenticated attack path, but authenticated clients can still trigger the crash. Restricting LDAP access to trusted networks reduces attack surface but does not eliminate the vulnerability.

Red Hat has released an official security update that fixes this vulnerability. Users should apply the updated 389-ds-base package for Red Hat Enterprise Linux 7 Extended Lifecycle Support as soon as possible. No practical workaround or mitigation has been identified by Red Hat. Restricting LDAP access to trusted networks and disabling anonymous LDAP access can reduce exposure but do not fully mitigate the issue.